Summary

Plex2Shell is an exploit chain that combines four Plex Media Server vulnerabilities, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. It lets an unauthenticated remote attacker reach internal functions, recover the server owner’s administrator token, and plant a malicious library in the Codecs directory to run code. Fixes shipped in version 1.43.3.10861 in August 2026, but a public proof of concept released on October 16, 2026 was weaponized within a day. Unpatched internet-facing servers are now being widely exploited to deploy XMRig cryptocurrency miners and myawesomeproxy proxyware, which turns victim systems into monetized relay nodes with a foothold in their surrounding networks.

CVEs

Vulnerability Details

Vulnerabilities

Recommendations

1. 01
   Upgrade Plex Media Server Immediately

   Update every Plex Media Server instance to version 1.43.3.10861 or later, which is not affected by any of the four vulnerabilities in the chain. Confirm the running build in Plex Web under Settings → General rather than trusting the update channel, because NAS package managers may lag behind the vendor release and those deployments may need the package installed manually from the Plex downloads page. Do not treat “1.43.3” alone as safe, because early 1.43.3 builds such as 1.43.3.10828 remain vulnerable, so verify that the full build number is 1.43.3.10861 or later.
2. 02
   Treat Exposed Unpatched Servers as Compromised

   Assume compromise on any server that ran a version older than 1.43.3.10861 while reachable from the internet until proven otherwise. Hunt for processes spawned by Plex Media Server that are not recognized, particularly myawesomeproxy, mylovelyminer, or x12345, unfamiliar .so or .dll files in the Plex Codecs folder, transcoder options in Preferences.xml that no administrator set, outbound connections to proxystream[.]st, and sustained high CPU utilization while nothing is playing.
3. 03
   Rebuild Compromised Servers and Reset Credentials

   Where compromise is confirmed or cannot be ruled out, rebuild the server from a clean installation instead of reusing the old Plex data directory, and at minimum purge the entire Codecs folder and review Preferences.xml. Sign out of all devices from the Plex account settings, change the Plex password to invalidate any exposed administrator token, and treat every mounted share and credential reachable by the Plex service account as potentially exposed.
4. 04
   Reduce Internet Exposure

   Disable Remote Access under Settings → Remote Access wherever it is not required, and avoid forwarding TCP port 32400 directly to the internet. Where remote streaming is a business need, place the server behind a VPN or an authenticated reverse proxy so the vulnerable APIs are not reachable by unauthenticated parties.
5. 05
   Restrict Outbound Traffic from Media Servers

   The public proof of concept depends on the server connecting outbound to attacker infrastructure, and post-exploitation proxyware relies on unrestricted egress. Limit outbound connections from media hosts to required Plex services, block proxystream[.]st at DNS and perimeter controls, and alert on new or high-volume outbound sessions originating from the Plex process.
6. 06
   Enforce Least Privilege and Segmentation

   Run Plex Media Server under a dedicated low-privilege service account with read-only access to media libraries, and keep it off network segments that host backups, management interfaces, or sensitive file shares, so that code execution in the Plex process does not translate into broader network access.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

References

• https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
• https://fieldeffect.com/blog/active-exploitation-plex2shell-vulnerabilities
• https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
• https://github.com/code-zm/plex2shell